Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs
Georgia Institute of Technology（佐治亚理工学院）；University of Bristol（布里斯托大学）；University of Maryland（马里兰大学）；University College London（伦敦大学学院）；MATS；Astra；MIT CSAIL（麻省理工学院计算机科学与人工智能实验室）
Abhay Sheshadri, Aidan Ewart, Phillip Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Hadfield-Menell, Stephen Casper
Large language models (LLMs) can often be made to behave in undesirable ways that they are explicitly fine-tuned not to. For example, the LLM red-teaming literature has produced a wide variety of 'jailbreaking' techniques to elicit harmful text from models that were fine-tuned to be harmless. Recent work on red-teaming, model editing, and interpretability suggests that this challenge stems from how (adversarial) fine-tuning largely serves to suppress rather than remove undesirable capabilities from LLMs. Prior work has introduced latent adversarial training (LAT) as a way to improve robustness to broad classes of failures. These prior works have considered untargeted latent space attacks where the adversary perturbs latent activations to maximize loss on examples of desirable behavior. Untargeted LAT can provide a generic type of robustness but does not leverage information about specific failure modes. Here, we experiment with targeted LAT where the adversary seeks to minimize loss on a specific competing task. We find that it can augment a wide variety of state-of-the-art methods. First, we use targeted LAT to improve robustness to jailbreaks, outperforming a strong R2D2 baseline with orders of magnitude less compute. Second, we use it to more effectively remove backdoors with no knowledge of the trigger. Finally, we use it to more effectively unlearn knowledge for specific undesirable tasks in a way that is also more robust to re-learning. Overall, our results suggest that targeted LAT can be an effective tool for defending against harmful behaviors from LLMs.
from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；People’s Public Security University of China（中国人民公安大学）；Tsinghua University（清华大学）
Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approach
City University of Hong Kong（香港城市大学）；Hefei University of Technology（合肥工业大学）；University of South Florida（南佛罗里达大学）；University of Georgia（佐治亚大学）；University of Maryland（马里兰大学）
The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homology
Microsoft Security Response Center（微软安全响应中心）；AIDOS Lab, University of Fribourg（弗里堡大学AIDOS实验室）；Department of Mathematics, Imperial College London（伦敦帝国理工学院数学系）；Queen Mary University of London（伦敦大学量子玛丽学院）；Imperial College London（伦敦帝国理工学院）；Language Technology Lab, University of Cambridge（剑桥大学语言技术实验室）；The Alan Turing Institute（艾伦·图灵研究所）
Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Content
Australian National University（澳大利亚国立大学）；Mathematical Sciences Institute（数学科学研究所）；Research School of Astronomy（天文研究学院）；College of Engineering and Computer Science（工程与计算机科学学院）
Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attacks
Lab of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能实验室，东华大学，上海200062，中国）；Shanghai Institute of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能研究所，东华大学，上海200062，中国）；School of Computer Science and Technology, East China Normal University, Shanghai 200062, China（计算机科学与技术学院，东华大学，上海200062，中国）
AdvChain: Adversarial Chain-of-Thought Tuning for Robust Safety Alignment of Large Reasoning Models
The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；State University of New York at Buffalo（纽约州立大学布法罗分校）；Huawei International, Singapore（新加坡华为国际）
Khoury College of Computer Sciences（胡里计算机学院）；Northeastern University（东北大学）
Motivated by the need for fair algorithmic decision making in the age of automation and artificially-intelligent technology, this technical report provides a theoretical insight into adversarial training for fairness in deep learning. We build upon previous work in adversarial fairness, show the persistent tradeoff between fair predictions and model performance, and explore further mechanisms that help in offsetting this tradeoff.
Diagnosing Harmful Continuation in Answer-Correct Long-CoT Training Traces
University of Electronic Science and Technology of China（电子科技大学）；Singapore University of Technology and Design（新加坡科技设计大学）；Singapore Management University（新加坡管理学院）
Adversarial Preference Learning for Robust LLM Alignment
Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）；Northeastern University（东北大学）；University of Science and Technology of China（中国科学技术大学）；MemTensor (Shanghai) Technology Co., Ltd（MemTensor（上海）技术有限公司）；University of Auckland（奥克兰大学）；China Telecom Corporation Limited Beijing Research Institute（中国电信股份有限公司北京研究院）
Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
University of Science and Technology of China（中国科学技术大学）；National University of Singapore（新加坡国立大学）；Singapore Management University（新加坡管理学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
Text-guided image generation models can be prompted to generate images using nonce words adversarially designed to robustly evoke specific visual concepts. Two approaches for such generation are introduced: macaronic prompting, which involves designing cryptic hybrid words by concatenating subword units from different languages; and evocative prompting, which involves designing nonce words whose broad morphological features are similar enough to that of existing words to trigger robust visual associations. The two methods can also be combined to generate images associated with more specific vi…
We study two aspects of noisy computations during inference. The first aspect is how to mitigate their side effects for naturally trained deep learning systems. One of the motivations for looking into this problem is to reduce the high power cost of conventional computing of neural networks through the use of analog neuromorphic circuits. Traditional GPU/CPU-centered deep learning architectures exhibit bottlenecks in power-restricted applications (e.g., embedded systems). The use of specialized neuromorphic circuits, where analog signals passed through memory-cell arrays are sensed to accompli…
MixAT: Combining Continuous and Discrete Adversarial Training for LLMs
INSAIT, Sofia University "St. Kliment Ohridski"（INSAIT，索菲亚大学"圣克莱孟·奥赫里迪斯基"）；ETH Zurich（苏黎世联邦理工学院）；ELTE Eötvös Loránd University, Budapest, Hungary（ELTE 爱斯特霍特·洛兰德大学，布达佩斯，匈牙利）
Detection of adversarial intent in Human-AI teams using LLMs
Department of Mechanical Engineering, University of California at Santa Barbara（加州大学圣巴巴拉分校机械工程系）；Department of Computer Science, University of California at Santa Barbara（加州大学圣巴巴拉分校计算机科学系）
The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring
Department of Computer Science, University of Texas at El Paso（德克萨斯大学埃尔帕索分校计算机科学系）；School of Computing, Southern Illinois University Carbondale（南方伊利诺伊大学卡罗尔丹分校计算学院）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
